mirror of
https://github.com/NixOS/nix
synced 2025-07-08 11:03:54 +02:00
Tagging release 2.28.0
-----BEGIN PGP SIGNATURE----- iQFHBAABCAAxFiEEtUHVUwEnDgvPFcpdgXC0cm1xmN4FAmfv9fITHGVkb2xzdHJh QGdtYWlsLmNvbQAKCRCBcLRybXGY3ohrCAC1Uw/JJr3yEPlJ/jLc9t9HqEKMY08W W6SEjpYJHYixMXmoonexkqojncNWBaiytRa+vBY7JQq0xTOOBwj42TM2ZzMF4GXi vO4Ox0hEsRa/v7tSmK6GFz1sNEKEUOHDNbilg4kzkkBHPEGPUGMwdWkT0akO576Q SQ6ERwPPLsHDI2YtAeAD8R4p07CraiyA34ljDPz3rChTAXRPVKWxJUt1enwEWYTr cKk45RcR4S8rP1BVwf3wsNsrHjqjbaY45kPAo8GD79hFH0zkyJarS3Kgv8qsWLra 9ph0DVVG0wiArlET7Y3uchqtAC0Z5LOnutAmOFYFw6DKfWp9yGfl/SVW =XRda -----END PGP SIGNATURE----- Merge tag '2.28.0' into sync-2.28.0 Tagging release 2.28.0
This commit is contained in:
commit
852075ec9d
697 changed files with 4531 additions and 3970 deletions
|
@ -132,5 +132,6 @@
|
|||
- [Release 3.0.0 (2025-03-04)](release-notes-determinate/rl-3.0.0.md)
|
||||
- [Nix Release Notes](release-notes/index.md)
|
||||
{{#include ./SUMMARY-rl-next.md}}
|
||||
- [Release 2.28 (2025-04-02)](release-notes/rl-2.28.md)
|
||||
- [Release 2.27 (2025-03-03)](release-notes/rl-2.27.md)
|
||||
- [Release 2.26 (2025-01-22)](release-notes/rl-2.26.md)
|
||||
|
|
|
@ -30,7 +30,7 @@ The unit tests are defined using the [googletest] and [rapidcheck] frameworks.
|
|||
> src
|
||||
> ├── libexpr
|
||||
> │ ├── meson.build
|
||||
> │ ├── value/context.hh
|
||||
> │ ├── include/nix/expr/value/context.hh
|
||||
> │ ├── value/context.cc
|
||||
> │ …
|
||||
> │
|
||||
|
@ -46,8 +46,12 @@ The unit tests are defined using the [googletest] and [rapidcheck] frameworks.
|
|||
> │ │
|
||||
> │ ├── libexpr-test-support
|
||||
> │ │ ├── meson.build
|
||||
> │ │ ├── include/nix/expr
|
||||
> │ │ │ ├── meson.build
|
||||
> │ │ │ └── tests
|
||||
> │ │ │ ├── value/context.hh
|
||||
> │ │ │ …
|
||||
> │ │ └── tests
|
||||
> │ │ ├── value/context.hh
|
||||
> │ │ ├── value/context.cc
|
||||
> │ │ …
|
||||
> │ │
|
||||
|
@ -59,7 +63,7 @@ The unit tests are defined using the [googletest] and [rapidcheck] frameworks.
|
|||
> ```
|
||||
|
||||
The tests for each Nix library (`libnixexpr`, `libnixstore`, etc..) live inside a directory `src/${library_name_without-nix}-test`.
|
||||
Given an interface (header) and implementation pair in the original library, say, `src/libexpr/value/context.{hh,cc}`, we write tests for it in `src/libexpr-tests/value/context.cc`, and (possibly) declare/define additional interfaces for testing purposes in `src/libexpr-test-support/tests/value/context.{hh,cc}`.
|
||||
Given an interface (header) and implementation pair in the original library, say, `src/libexpr/include/nix/expr/value/context.hh` and `src/libexpr/value/context.cc`, we write tests for it in `src/libexpr-tests/value/context.cc`, and (possibly) declare/define additional interfaces for testing purposes in `src/libexpr-test-support/include/nix/expr/tests/value/context.hh` and `src/libexpr-test-support/tests/value/context.cc`.
|
||||
|
||||
Data for unit tests is stored in a `data` subdir of the directory for each unit test executable.
|
||||
For example, `libnixstore` code is in `src/libstore`, and its test data is in `src/libstore-tests/data`.
|
||||
|
@ -67,7 +71,7 @@ The path to the `src/${library_name_without-nix}-test/data` directory is passed
|
|||
Note that each executable only gets the data for its tests.
|
||||
|
||||
The unit test libraries are in `src/${library_name_without-nix}-test-support`.
|
||||
All headers are in a `tests` subdirectory so they are included with `#include "tests/"`.
|
||||
All headers are in a `tests` subdirectory so they are included with `#include "nix/tests/"`.
|
||||
|
||||
The use of all these separate directories for the unit tests might seem inconvenient, as for example the tests are not "right next to" the part of the code they are testing.
|
||||
But organizing the tests this way has one big benefit:
|
||||
|
|
|
@ -2,6 +2,83 @@
|
|||
|
||||
Derivations can declare some infrequently used optional attributes.
|
||||
|
||||
## Inputs
|
||||
|
||||
- [`exportReferencesGraph`]{#adv-attr-exportReferencesGraph}\
|
||||
This attribute allows builders access to the references graph of
|
||||
their inputs. The attribute is a list of inputs in the Nix store
|
||||
whose references graph the builder needs to know. The value of
|
||||
this attribute should be a list of pairs `[ name1 path1 name2
|
||||
path2 ... ]`. The references graph of each *pathN* will be stored
|
||||
in a text file *nameN* in the temporary build directory. The text
|
||||
files have the format used by `nix-store --register-validity`
|
||||
(with the deriver fields left empty). For example, when the
|
||||
following derivation is built:
|
||||
|
||||
```nix
|
||||
derivation {
|
||||
...
|
||||
exportReferencesGraph = [ "libfoo-graph" libfoo ];
|
||||
};
|
||||
```
|
||||
|
||||
the references graph of `libfoo` is placed in the file
|
||||
`libfoo-graph` in the temporary build directory.
|
||||
|
||||
`exportReferencesGraph` is useful for builders that want to do
|
||||
something with the closure of a store path. Examples include the
|
||||
builders in NixOS that generate the initial ramdisk for booting
|
||||
Linux (a `cpio` archive containing the closure of the boot script)
|
||||
and the ISO-9660 image for the installation CD (which is populated
|
||||
with a Nix store containing the closure of a bootable NixOS
|
||||
configuration).
|
||||
|
||||
- [`passAsFile`]{#adv-attr-passAsFile}\
|
||||
A list of names of attributes that should be passed via files rather
|
||||
than environment variables. For example, if you have
|
||||
|
||||
```nix
|
||||
passAsFile = ["big"];
|
||||
big = "a very long string";
|
||||
```
|
||||
|
||||
then when the builder runs, the environment variable `bigPath`
|
||||
will contain the absolute path to a temporary file containing `a
|
||||
very long string`. That is, for any attribute *x* listed in
|
||||
`passAsFile`, Nix will pass an environment variable `xPath`
|
||||
holding the path of the file containing the value of attribute
|
||||
*x*. This is useful when you need to pass large strings to a
|
||||
builder, since most operating systems impose a limit on the size
|
||||
of the environment (typically, a few hundred kilobyte).
|
||||
|
||||
- [`__structuredAttrs`]{#adv-attr-structuredAttrs}\
|
||||
If the special attribute `__structuredAttrs` is set to `true`, the other derivation
|
||||
attributes are serialised into a file in JSON format. The environment variable
|
||||
`NIX_ATTRS_JSON_FILE` points to the exact location of that file both in a build
|
||||
and a [`nix-shell`](../command-ref/nix-shell.md). This obviates the need for
|
||||
[`passAsFile`](#adv-attr-passAsFile) since JSON files have no size restrictions,
|
||||
unlike process environments.
|
||||
|
||||
It also makes it possible to tweak derivation settings in a structured way; see
|
||||
[`outputChecks`](#adv-attr-outputChecks) for example.
|
||||
|
||||
As a convenience to Bash builders,
|
||||
Nix writes a script that initialises shell variables
|
||||
corresponding to all attributes that are representable in Bash. The
|
||||
environment variable `NIX_ATTRS_SH_FILE` points to the exact
|
||||
location of the script, both in a build and a
|
||||
[`nix-shell`](../command-ref/nix-shell.md). This includes non-nested
|
||||
(associative) arrays. For example, the attribute `hardening.format = true`
|
||||
ends up as the Bash associative array element `${hardening[format]}`.
|
||||
|
||||
> **Warning**
|
||||
>
|
||||
> If set to `true`, other advanced attributes such as [`allowedReferences`](#adv-attr-allowedReferences), [`allowedReferences`](#adv-attr-allowedReferences), [`allowedRequisites`](#adv-attr-allowedRequisites),
|
||||
[`disallowedReferences`](#adv-attr-disallowedReferences) and [`disallowedRequisites`](#adv-attr-disallowedRequisites), maxSize, and maxClosureSize.
|
||||
will have no effect.
|
||||
|
||||
## Output checks
|
||||
|
||||
- [`allowedReferences`]{#adv-attr-allowedReferences}\
|
||||
The optional attribute `allowedReferences` specifies a list of legal
|
||||
references (dependencies) of the output of the builder. For example,
|
||||
|
@ -55,34 +132,89 @@ Derivations can declare some infrequently used optional attributes.
|
|||
dependency on `foobar` or any other derivation depending recursively
|
||||
on `foobar`.
|
||||
|
||||
- [`exportReferencesGraph`]{#adv-attr-exportReferencesGraph}\
|
||||
This attribute allows builders access to the references graph of
|
||||
their inputs. The attribute is a list of inputs in the Nix store
|
||||
whose references graph the builder needs to know. The value of
|
||||
this attribute should be a list of pairs `[ name1 path1 name2
|
||||
path2 ... ]`. The references graph of each *pathN* will be stored
|
||||
in a text file *nameN* in the temporary build directory. The text
|
||||
files have the format used by `nix-store --register-validity`
|
||||
(with the deriver fields left empty). For example, when the
|
||||
following derivation is built:
|
||||
- [`outputChecks`]{#adv-attr-outputChecks}\
|
||||
When using [structured attributes](#adv-attr-structuredAttrs), the `outputChecks`
|
||||
attribute allows defining checks per-output.
|
||||
|
||||
In addition to
|
||||
[`allowedReferences`](#adv-attr-allowedReferences), [`allowedRequisites`](#adv-attr-allowedRequisites),
|
||||
[`disallowedReferences`](#adv-attr-disallowedReferences) and [`disallowedRequisites`](#adv-attr-disallowedRequisites),
|
||||
the following attributes are available:
|
||||
|
||||
- `maxSize` defines the maximum size of the resulting [store object](@docroot@/store/store-object.md).
|
||||
- `maxClosureSize` defines the maximum size of the output's closure.
|
||||
- `ignoreSelfRefs` controls whether self-references should be considered when
|
||||
checking for allowed references/requisites.
|
||||
|
||||
Example:
|
||||
|
||||
```nix
|
||||
derivation {
|
||||
...
|
||||
exportReferencesGraph = [ "libfoo-graph" libfoo ];
|
||||
__structuredAttrs = true;
|
||||
|
||||
outputChecks.out = {
|
||||
# The closure of 'out' must not be larger than 256 MiB.
|
||||
maxClosureSize = 256 * 1024 * 1024;
|
||||
|
||||
# It must not refer to the C compiler or to the 'dev' output.
|
||||
disallowedRequisites = [ stdenv.cc "dev" ];
|
||||
};
|
||||
|
||||
outputChecks.dev = {
|
||||
# The 'dev' output must not be larger than 128 KiB.
|
||||
maxSize = 128 * 1024;
|
||||
};
|
||||
```
|
||||
|
||||
the references graph of `libfoo` is placed in the file
|
||||
`libfoo-graph` in the temporary build directory.
|
||||
## Other output modifications
|
||||
|
||||
`exportReferencesGraph` is useful for builders that want to do
|
||||
something with the closure of a store path. Examples include the
|
||||
builders in NixOS that generate the initial ramdisk for booting
|
||||
Linux (a `cpio` archive containing the closure of the boot script)
|
||||
and the ISO-9660 image for the installation CD (which is populated
|
||||
with a Nix store containing the closure of a bootable NixOS
|
||||
configuration).
|
||||
- [`unsafeDiscardReferences`]{#adv-attr-unsafeDiscardReferences}\
|
||||
|
||||
When using [structured attributes](#adv-attr-structuredAttrs), the
|
||||
attribute `unsafeDiscardReferences` is an attribute set with a boolean value for each output name.
|
||||
If set to `true`, it disables scanning the output for runtime dependencies.
|
||||
|
||||
Example:
|
||||
|
||||
```nix
|
||||
__structuredAttrs = true;
|
||||
unsafeDiscardReferences.out = true;
|
||||
```
|
||||
|
||||
This is useful, for example, when generating self-contained filesystem images with
|
||||
their own embedded Nix store: hashes found inside such an image refer
|
||||
to the embedded store and not to the host's Nix store.
|
||||
|
||||
## Build scheduling
|
||||
|
||||
- [`preferLocalBuild`]{#adv-attr-preferLocalBuild}\
|
||||
If this attribute is set to `true` and [distributed building is enabled](@docroot@/command-ref/conf-file.md#conf-builders), then, if possible, the derivation will be built locally instead of being forwarded to a remote machine.
|
||||
This is useful for derivations that are cheapest to build locally.
|
||||
|
||||
- [`allowSubstitutes`]{#adv-attr-allowSubstitutes}\
|
||||
If this attribute is set to `false`, then Nix will always build this derivation (locally or remotely); it will not try to substitute its outputs.
|
||||
This is useful for derivations that are cheaper to build than to substitute.
|
||||
|
||||
This attribute can be ignored by setting [`always-allow-substitutes`](@docroot@/command-ref/conf-file.md#conf-always-allow-substitutes) to `true`.
|
||||
|
||||
> **Note**
|
||||
>
|
||||
> If set to `false`, the [`builder`] should be able to run on the system type specified in the [`system` attribute](./derivations.md#attr-system), since the derivation cannot be substituted.
|
||||
|
||||
[`builder`]: ./derivations.md#attr-builder
|
||||
|
||||
- [`requiredSystemFeatures`]{#adv-attr-requiredSystemFeatures}\
|
||||
|
||||
If a derivation has the `requiredSystemFeatures` attribute, then Nix will only build it on a machine that has the corresponding features set in its [`system-features` configuration](@docroot@/command-ref/conf-file.md#conf-system-features).
|
||||
|
||||
For example, setting
|
||||
|
||||
```nix
|
||||
requiredSystemFeatures = [ "kvm" ];
|
||||
```
|
||||
|
||||
ensures that the derivation can only be built on a machine with the `kvm` feature.
|
||||
|
||||
# Impure builder configuration
|
||||
|
||||
- [`impureEnvVars`]{#adv-attr-impureEnvVars}\
|
||||
This attribute allows you to specify a list of environment variables
|
||||
|
@ -119,128 +251,6 @@ Derivations can declare some infrequently used optional attributes.
|
|||
[`impure-env`](@docroot@/command-ref/conf-file.md#conf-impure-env)
|
||||
configuration setting.
|
||||
|
||||
- [`passAsFile`]{#adv-attr-passAsFile}\
|
||||
A list of names of attributes that should be passed via files rather
|
||||
than environment variables. For example, if you have
|
||||
|
||||
```nix
|
||||
passAsFile = ["big"];
|
||||
big = "a very long string";
|
||||
```
|
||||
|
||||
then when the builder runs, the environment variable `bigPath`
|
||||
will contain the absolute path to a temporary file containing `a
|
||||
very long string`. That is, for any attribute *x* listed in
|
||||
`passAsFile`, Nix will pass an environment variable `xPath`
|
||||
holding the path of the file containing the value of attribute
|
||||
*x*. This is useful when you need to pass large strings to a
|
||||
builder, since most operating systems impose a limit on the size
|
||||
of the environment (typically, a few hundred kilobyte).
|
||||
|
||||
- [`preferLocalBuild`]{#adv-attr-preferLocalBuild}\
|
||||
If this attribute is set to `true` and [distributed building is enabled](@docroot@/command-ref/conf-file.md#conf-builders), then, if possible, the derivation will be built locally instead of being forwarded to a remote machine.
|
||||
This is useful for derivations that are cheapest to build locally.
|
||||
|
||||
- [`allowSubstitutes`]{#adv-attr-allowSubstitutes}\
|
||||
If this attribute is set to `false`, then Nix will always build this derivation (locally or remotely); it will not try to substitute its outputs.
|
||||
This is useful for derivations that are cheaper to build than to substitute.
|
||||
|
||||
This attribute can be ignored by setting [`always-allow-substitutes`](@docroot@/command-ref/conf-file.md#conf-always-allow-substitutes) to `true`.
|
||||
|
||||
> **Note**
|
||||
>
|
||||
> If set to `false`, the [`builder`] should be able to run on the system type specified in the [`system` attribute](./derivations.md#attr-system), since the derivation cannot be substituted.
|
||||
|
||||
[`builder`]: ./derivations.md#attr-builder
|
||||
|
||||
- [`__structuredAttrs`]{#adv-attr-structuredAttrs}\
|
||||
If the special attribute `__structuredAttrs` is set to `true`, the other derivation
|
||||
attributes are serialised into a file in JSON format. The environment variable
|
||||
`NIX_ATTRS_JSON_FILE` points to the exact location of that file both in a build
|
||||
and a [`nix-shell`](../command-ref/nix-shell.md). This obviates the need for
|
||||
[`passAsFile`](#adv-attr-passAsFile) since JSON files have no size restrictions,
|
||||
unlike process environments.
|
||||
|
||||
It also makes it possible to tweak derivation settings in a structured way; see
|
||||
[`outputChecks`](#adv-attr-outputChecks) for example.
|
||||
|
||||
As a convenience to Bash builders,
|
||||
Nix writes a script that initialises shell variables
|
||||
corresponding to all attributes that are representable in Bash. The
|
||||
environment variable `NIX_ATTRS_SH_FILE` points to the exact
|
||||
location of the script, both in a build and a
|
||||
[`nix-shell`](../command-ref/nix-shell.md). This includes non-nested
|
||||
(associative) arrays. For example, the attribute `hardening.format = true`
|
||||
ends up as the Bash associative array element `${hardening[format]}`.
|
||||
|
||||
> **Warning**
|
||||
>
|
||||
> If set to `true`, other advanced attributes such as [`allowedReferences`](#adv-attr-allowedReferences), [`allowedReferences`](#adv-attr-allowedReferences), [`allowedRequisites`](#adv-attr-allowedRequisites),
|
||||
[`disallowedReferences`](#adv-attr-disallowedReferences) and [`disallowedRequisites`](#adv-attr-disallowedRequisites), maxSize, and maxClosureSize.
|
||||
will have no effect.
|
||||
|
||||
- [`outputChecks`]{#adv-attr-outputChecks}\
|
||||
When using [structured attributes](#adv-attr-structuredAttrs), the `outputChecks`
|
||||
attribute allows defining checks per-output.
|
||||
|
||||
In addition to
|
||||
[`allowedReferences`](#adv-attr-allowedReferences), [`allowedRequisites`](#adv-attr-allowedRequisites),
|
||||
[`disallowedReferences`](#adv-attr-disallowedReferences) and [`disallowedRequisites`](#adv-attr-disallowedRequisites),
|
||||
the following attributes are available:
|
||||
|
||||
- `maxSize` defines the maximum size of the resulting [store object](@docroot@/store/store-object.md).
|
||||
- `maxClosureSize` defines the maximum size of the output's closure.
|
||||
- `ignoreSelfRefs` controls whether self-references should be considered when
|
||||
checking for allowed references/requisites.
|
||||
|
||||
Example:
|
||||
|
||||
```nix
|
||||
__structuredAttrs = true;
|
||||
|
||||
outputChecks.out = {
|
||||
# The closure of 'out' must not be larger than 256 MiB.
|
||||
maxClosureSize = 256 * 1024 * 1024;
|
||||
|
||||
# It must not refer to the C compiler or to the 'dev' output.
|
||||
disallowedRequisites = [ stdenv.cc "dev" ];
|
||||
};
|
||||
|
||||
outputChecks.dev = {
|
||||
# The 'dev' output must not be larger than 128 KiB.
|
||||
maxSize = 128 * 1024;
|
||||
};
|
||||
```
|
||||
|
||||
- [`unsafeDiscardReferences`]{#adv-attr-unsafeDiscardReferences}\
|
||||
|
||||
When using [structured attributes](#adv-attr-structuredAttrs), the
|
||||
attribute `unsafeDiscardReferences` is an attribute set with a boolean value for each output name.
|
||||
If set to `true`, it disables scanning the output for runtime dependencies.
|
||||
|
||||
Example:
|
||||
|
||||
```nix
|
||||
__structuredAttrs = true;
|
||||
unsafeDiscardReferences.out = true;
|
||||
```
|
||||
|
||||
This is useful, for example, when generating self-contained filesystem images with
|
||||
their own embedded Nix store: hashes found inside such an image refer
|
||||
to the embedded store and not to the host's Nix store.
|
||||
|
||||
- [`requiredSystemFeatures`]{#adv-attr-requiredSystemFeatures}\
|
||||
|
||||
If a derivation has the `requiredSystemFeatures` attribute, then Nix will only build it on a machine that has the corresponding features set in its [`system-features` configuration](@docroot@/command-ref/conf-file.md#conf-system-features).
|
||||
|
||||
For example, setting
|
||||
|
||||
```nix
|
||||
requiredSystemFeatures = [ "kvm" ];
|
||||
```
|
||||
|
||||
ensures that the derivation can only be built on a machine with the `kvm` feature.
|
||||
|
||||
## Setting the derivation type
|
||||
|
||||
As discussed in [Derivation Outputs and Types of Derivations](@docroot@/store/derivation/outputs/index.md), there are multiples kinds of derivations / kinds of derivation outputs.
|
||||
|
|
|
@ -443,7 +443,7 @@ three kinds of patterns:
|
|||
This works on any set that contains at least the three named
|
||||
attributes.
|
||||
|
||||
It is possible to provide *default values* for attributes, in
|
||||
- It is possible to provide *default values* for attributes, in
|
||||
which case they are allowed to be missing. A default value is
|
||||
specified by writing `name ? e`, where *e* is an arbitrary
|
||||
expression. For example,
|
||||
|
@ -503,6 +503,45 @@ three kinds of patterns:
|
|||
> [ 23 {} ]
|
||||
> ```
|
||||
|
||||
- All bindings introduced by the function are in scope in the entire function expression; not just in the body.
|
||||
It can therefore be used in default values.
|
||||
|
||||
> **Example**
|
||||
>
|
||||
> A parameter (`x`), is used in the default value for another parameter (`y`):
|
||||
>
|
||||
> ```nix
|
||||
> let
|
||||
> f = { x, y ? [x] }: { inherit y; };
|
||||
> in
|
||||
> f { x = 3; }
|
||||
> ```
|
||||
>
|
||||
> This evaluates to:
|
||||
>
|
||||
> ```nix
|
||||
> {
|
||||
> y = [ 3 ];
|
||||
> }
|
||||
> ```
|
||||
|
||||
> **Example**
|
||||
>
|
||||
> The binding of an `@` pattern, `args`, is used in the default value for a parameter, `x`:
|
||||
>
|
||||
> ```nix
|
||||
> let
|
||||
> f = args@{ x ? args.a, ... }: x;
|
||||
> in
|
||||
> f { a = 1; }
|
||||
> ```
|
||||
>
|
||||
> This evaluates to:
|
||||
>
|
||||
> ```nix
|
||||
> 1
|
||||
> ```
|
||||
|
||||
Note that functions do not have names. If you want to give them a name,
|
||||
you can bind them to an attribute, e.g.,
|
||||
|
||||
|
|
|
@ -7,7 +7,7 @@ The format of this specification is close to [Extended Backus–Naur form](https
|
|||
Regular users do *not* need to know this information --- store paths can be treated as black boxes computed from the properties of the store objects they refer to.
|
||||
But for those interested in exactly how Nix works, e.g. if they are reimplementing it, this information can be useful.
|
||||
|
||||
[store path](@docroot@/store/store-path.md)
|
||||
[store path]: @docroot@/store/store-path.md
|
||||
|
||||
## Store path proper
|
||||
|
||||
|
@ -20,14 +20,17 @@ where
|
|||
|
||||
- `store-dir` = the [store directory](@docroot@/store/store-path.md#store-directory)
|
||||
|
||||
- `digest` = base-32 representation of the first 160 bits of a [SHA-256] hash of `fingerprint`
|
||||
- `digest` = base-32 representation of the compressed to 160 bits [SHA-256] hash of `fingerprint`
|
||||
|
||||
This the hash part of the store name
|
||||
For the definition of the hash compression algorithm, please refer to the section 5.1 of
|
||||
the [Nix thesis](https://edolstra.github.io/pubs/phd-thesis.pdf), which also defines the
|
||||
specifics of base-32 encoding. Note that base-32 encoding processes the hash bytestring from
|
||||
the end, while base-16 processes in from the beginning.
|
||||
|
||||
## Fingerprint
|
||||
|
||||
- ```ebnf
|
||||
fingerprint = type ":" sha256 ":" inner-digest ":" store ":" name
|
||||
fingerprint = type ":sha256:" inner-digest ":" store ":" name
|
||||
```
|
||||
|
||||
Note that it includes the location of the store as well as the name to make sure that changes to either of those are reflected in the hash
|
||||
|
@ -70,7 +73,8 @@ where
|
|||
`id` is the name of the output (usually, "out").
|
||||
For content-addressed store objects, `id`, is always "out".
|
||||
|
||||
- `inner-digest` = base-16 representation of a SHA-256 hash of `inner-fingerprint`
|
||||
- `inner-digest` = base-16 representation of a SHA-256 hash of `inner-fingerprint`.
|
||||
The base-16 encoding uses lower-cased hex digits.
|
||||
|
||||
## Inner fingerprint
|
||||
|
||||
|
@ -82,7 +86,7 @@ where
|
|||
|
||||
- if `type` = `"source:" ...`:
|
||||
|
||||
the hash of the [Nix Archive (NAR)] serialization of the [file system object](@docroot@/store/file-system-object.md) of the store object.
|
||||
the [Nix Archive (NAR)] serialization of the [file system object](@docroot@/store/file-system-object.md) of the store object.
|
||||
|
||||
- if `type` = `"output:" id`:
|
||||
|
||||
|
|
105
doc/manual/source/release-notes/rl-2.28.md
Normal file
105
doc/manual/source/release-notes/rl-2.28.md
Normal file
|
@ -0,0 +1,105 @@
|
|||
# Release 2.28.0 (2025-04-02)
|
||||
|
||||
This is an atypical release, and for almost all intents and purposes, it is just a continuation of 2.27; not a feature release.
|
||||
|
||||
We had originally set the goal of making 2.27 the Nixpkgs default for NixOS 25.05, but dependents that link to Nix need certain _interface breaking_ changes in the C++ headers. This is not something we should do in a patch release, so this is why we branched 2.28 right off 2.27 instead of `master`.
|
||||
|
||||
This completes the infrastructure overhaul for the [RFC 132](https://github.com/NixOS/rfcs/blob/master/rfcs/0132-meson-builds-nix.md) switchover to meson as our build system.
|
||||
|
||||
## Major changes
|
||||
|
||||
- Unstable C++ API reworked
|
||||
[#12836](https://github.com/NixOS/nix/pull/12836)
|
||||
[#12798](https://github.com/NixOS/nix/pull/12798)
|
||||
[#12773](https://github.com/NixOS/nix/pull/12773)
|
||||
|
||||
Now the C++ interface confirms to common conventions much better than before:
|
||||
|
||||
- All headers are expected to be included with the initial `nix/`, e.g. as `#include "nix/....hh"` (what Nix's headers now do) or `#include <nix/....hh>` (what downstream projects may choose to do).
|
||||
Likewise, the pkg-config files have `-I${includedir}` not `-I${includedir}/nix` or similar.
|
||||
|
||||
Including without the `nix/` like before sometimes worked because of how for `#include` C pre-process checks the directory containing the current file, not just the lookup path, but this was not reliable.
|
||||
|
||||
- All configuration headers are included explicitly by the (regular) headers that need them.
|
||||
There is no more need to pass `-include` to force additional files to be included.
|
||||
|
||||
- The public, installed configuration headers no longer contain implementation-specific details that are not relevant to the API.
|
||||
The vast majority of definitions that were previously in there are now moved to new headers that are not installed, but used during Nix's own compilation only.
|
||||
The remaining macro definitions are renamed to have `NIX_` as a prefix.
|
||||
|
||||
- The name of the Nix component the header comes from
|
||||
(e.g. `util`, `store`, `expr`, `flake`, etc.)
|
||||
is now part of the path to the header, coming after `nix` and before the header name
|
||||
(or rest of the header path, if it is already in a directory).
|
||||
|
||||
Here is a contrived diff showing a few of these changes at once:
|
||||
|
||||
```diff
|
||||
@@ @@
|
||||
-#include "derived-path.hh"
|
||||
+#include "nix/store/derived-path.hh"
|
||||
@@ @@
|
||||
+// Would include for the variables used before. But when other headers
|
||||
+// need these variables. those will include these config themselves.
|
||||
+#include "nix/store/config.hh"
|
||||
+#include "nix/expr/config.hh"
|
||||
@@ @@
|
||||
-#include "config.hh"
|
||||
+// Additionally renamed to distinguish from components' config headers.
|
||||
+#include "nix/util/configuration.hh"
|
||||
@@ @@
|
||||
-#if HAVE_ACL_SUPPORT
|
||||
+#if NIX_SUPPORT_ACL
|
||||
@@ @@
|
||||
-#if HAVE_BOEHMGC
|
||||
+#if NIX_USE_BOEHMGC
|
||||
@@ @@
|
||||
#endif
|
||||
#endif
|
||||
@@ @@
|
||||
-const char *s = "hi from " SYSTEM;
|
||||
+const char *s = "hi from " NIX_LOCAL_SYSTEM;
|
||||
```
|
||||
|
||||
- C API `nix_flake_init_global` removed [#5638](https://github.com/NixOS/nix/issues/5638) [#12759](https://github.com/NixOS/nix/pull/12759)
|
||||
|
||||
In order to improve the modularity of the code base, we are removing a use of global state, and therefore the `nix_flake_init_global` function.
|
||||
|
||||
Instead, use `nix_flake_settings_add_to_eval_state_builder`.
|
||||
For example:
|
||||
|
||||
```diff
|
||||
- nix_flake_init_global(ctx, settings);
|
||||
- HANDLE_ERROR(ctx);
|
||||
-
|
||||
nix_eval_state_builder * builder = nix_eval_state_builder_new(ctx, store);
|
||||
HANDLE_ERROR(ctx);
|
||||
|
||||
+ nix_flake_settings_add_to_eval_state_builder(ctx, settings, builder);
|
||||
+ HANDLE_ERROR(ctx);
|
||||
```
|
||||
|
||||
Although this change is not as critical, we figured it would be good to do this API change at the same time, also.
|
||||
Also note that we try to keep the C API compatible, but we decided to break this function because it was young and likely not in widespread use yet. This frees up time to make important progress on the rest of the C API.
|
||||
|
||||
# Contributors
|
||||
|
||||
This earlier-than-usual release was made possible by the following 16 contributors:
|
||||
|
||||
- Farid Zakaria [**(@fzakaria)**](https://github.com/fzakaria)
|
||||
- Jörg Thalheim [**(@Mic92)**](https://github.com/Mic92)
|
||||
- Eelco Dolstra [**(@edolstra)**](https://github.com/edolstra)
|
||||
- Graham Christensen [**(@grahamc)**](https://github.com/grahamc)
|
||||
- Thomas Miedema [**(@thomie)**](https://github.com/thomie)
|
||||
- Brian McKenna [**(@puffnfresh)**](https://github.com/puffnfresh)
|
||||
- Sergei Trofimovich [**(@trofi)**](https://github.com/trofi)
|
||||
- Dmitry Bogatov [**(@KAction)**](https://github.com/KAction)
|
||||
- Erik Nygren [**(@Kirens)**](https://github.com/Kirens)
|
||||
- John Ericson [**(@Ericson2314)**](https://github.com/Ericson2314)
|
||||
- Sergei Zimmerman [**(@xokdvium)**](https://github.com/xokdvium)
|
||||
- Ruby Rose [**(@oldshensheep)**](https://github.com/oldshensheep)
|
||||
- Robert Hensing [**(@roberth)**](https://github.com/roberth)
|
||||
- jade [**(@lf-)**](https://github.com/lf-)
|
||||
- Félix [**(@picnoir)**](https://github.com/picnoir)
|
||||
- Valentin Gagarin [**(@fricklerhandwerk)**](https://github.com/fricklerhandwerk)
|
||||
- Dmitry Bogatov
|
|
@ -1,7 +1,7 @@
|
|||
# Derivation Outputs and Types of Derivations
|
||||
|
||||
As stated on the [main pages on derivations](../index.md#store-derivation),
|
||||
a derivation produces [store objects], which are known as the *outputs* of the derivation.
|
||||
a derivation produces [store objects](@docroot@/store/store-object.md), which are known as the *outputs* of the derivation.
|
||||
Indeed, the entire point of derivations is to produce these outputs, and to reliably and reproducably produce these derivations each time the derivation is run.
|
||||
|
||||
One of the parts of a derivation is its *outputs specification*, which specifies certain information about the outputs the derivation produces when run.
|
||||
|
@ -9,7 +9,7 @@ The outputs specification is a map, from names to specifications for individual
|
|||
|
||||
## Output Names {#outputs}
|
||||
|
||||
Output names can be any string which is also a valid [store path] name.
|
||||
Output names can be any string which is also a valid [store path](@docroot@/store/store-path.md) name.
|
||||
The name mapped to each output specification is not actually the name of the output.
|
||||
In the general case, the output store object has name `derivationName + "-" + outputSpecName`, not any other metadata about it.
|
||||
However, an output spec named "out" describes and output store object whose name is just the derivation name.
|
||||
|
@ -24,11 +24,11 @@ However, an output spec named "out" describes and output store object whose name
|
|||
>
|
||||
> - The store path of `dev` will be: `/nix/store/<hash>-hello-dev`.
|
||||
|
||||
The outputs are the derivations are the [store objects][store object] it is obligated to produce.
|
||||
The outputs are the derivations are the [store objects](@docroot@/store/store-object.md) it is obligated to produce.
|
||||
|
||||
> **Note**
|
||||
>
|
||||
> The formal terminology here is somewhat at adds with everyday communication in the Nix community today.
|
||||
> The formal terminology here is somewhat at odds with everyday communication in the Nix community today.
|
||||
> "output" in casual usage tends to refer to either to the actual output store object, or the notional output spec, depending on context.
|
||||
>
|
||||
> For example "hello's `dev` output" means the store object referred to by the store path `/nix/store/<hash>-hello-dev`.
|
||||
|
@ -64,7 +64,7 @@ The rules for this are fairly concise:
|
|||
|
||||
(This is an arbitrary restriction that could be lifted.)
|
||||
|
||||
- The output is either *fixed* or *floating*, indicating whether the its store path is known prior to building it.
|
||||
- The output is either *fixed* or *floating*, indicating whether the store path is known prior to building it.
|
||||
|
||||
- With fixed content-addressing it is fixed.
|
||||
|
||||
|
|
|
@ -46,7 +46,7 @@ be many different serialisations.
|
|||
For these reasons, Nix has its very own archive format—the Nix Archive (NAR) format,
|
||||
which is carefully designed to avoid the problems described above.
|
||||
|
||||
The exact specification of the Nix Archive format is in `protocols/nix-archive.md`
|
||||
The exact specification of the Nix Archive format is in [specified here](../../protocols/nix-archive.md).
|
||||
|
||||
## Content addressing File System Objects beyond a single serialisation pass
|
||||
|
||||
|
@ -80,6 +80,7 @@ Thus, Git can encode some, but not all of Nix's "File System Objects", and this
|
|||
|
||||
In the future, we may support a Git-like hash for such file system objects, or we may adopt another Merkle DAG format which is capable of representing all Nix file system objects.
|
||||
|
||||
|
||||
[file system object]: ../file-system-object.md
|
||||
[store object]: ../store-object.md
|
||||
[xp-feature-git-hashing]: @docroot@/development/experimental-features.md#xp-feature-git-hashing
|
||||
|
|
|
@ -50,7 +50,7 @@ The hashes of these modified input streams are used instead.
|
|||
|
||||
When validating the content address of a store object after the fact, the above process works as written.
|
||||
However, when first creating the store object we don't know the store object's store path, as explained just above.
|
||||
We therefore, strictly speaking, do not know what value we will be replacing with the sentinental value in the inputs to hash functions.
|
||||
We therefore, strictly speaking, do not know what value we will be replacing with the sentinel value in the inputs to hash functions.
|
||||
What instead happens is that the provisional store object --- the data from which we wish to create a store object --- is paired with a provisional "scratch" store path (that presumably was chosen when the data was created).
|
||||
That provisional store path is instead what is replaced with the sentinel value, rather than the final store object which we do not yet know.
|
||||
|
||||
|
|
Loading…
Add table
Add a link
Reference in a new issue